fix(login): a denied device request says how to recover; pin @types/node majors

[AetherAI3]

Two loose ends from the LOOP-17 device-auth work.

The denial message

The CLI reported a denial as authorization denied in the browser — a verdict with no next step, which reads like the account was rejected rather than one request being refused. Denial is recoverable: nothing was authorized, no key was created, and re-running the command starts a fresh request. The message now says so.

It also names something the user cannot otherwise know. A device request is bound to nobody until someone acts on it, so any signed-in account that learns a user_code can refuse it. A denial the user did not perform therefore means their code reached somebody else — worth telling them while the terminal is still open. This is the CLI half of the accepted-risk note in the 2026-07-28 phishing-resistance spec.

Deliberately one line: formatErrorLine puts its glyph on the first line only, so a multi-line message loses it on every subsequent line. I tried the multi-line version first and login.test.ts caught both that and the wording — the final message keeps the existing assertions passing unchanged, which is the right outcome for a test that was guarding real rendering behaviour.

The @types/node pin

@types/node must track engines.node (">=24"), not the newest release. A major bump types the project against a Node it doesn't claim to support, so tsc starts accepting APIs that don't exist for users on the supported version — a type error that only surfaces at their runtime.

migration_guard asserts that pairing, so a major bump lands as red CI on main. #52 did exactly that and main stayed broken until I reverted it as part of #56. Ignoring majors stops it recurring; minor and patch updates still flow. Raise it deliberately, alongside engines.node, when the floor actually moves.

Test plan

• npm run typecheck clean
• 823 pass, 0 fail
• dependabot.yml parses
• Existing login.test.ts denial assertions pass without modification

🤖 Generated with Claude Code